This Data Processing Addendum ("DPA") forms part of the agreement between the customer identified by the Hagency account or applicable order ("Customer") and Hagency for the Services ("Agreement"). It applies only to the extent Hagency processes Customer Personal Data on Customer's behalf. It is effective when Customer accepts the Agreement or first submits Customer Personal Data, whichever occurs first. Capitalized terms not defined here have the meaning in the Agreement.
If this DPA conflicts with the Agreement concerning processing of Customer Personal Data, this DPA controls. The Agreement otherwise remains effective, including its fees, warranty disclaimers and liability limits. Nothing in this DPA makes Hagency a controller of Customer Personal Data processed solely on Customer's behalf.
"Applicable Data Protection Law" means privacy and data-protection law applicable to the processing under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss Federal Act on Data Protection and United States state privacy laws. "Customer Personal Data" means personal data contained in Customer Data that Hagency processes as processor, service provider or contractor on Customer's behalf. "Data Subject", "controller", "processor", "processing", "personal data", "personal data breach" and "supervisory authority" have the meanings in Applicable Data Protection Law. "Subprocessor" means a third party engaged by Hagency to process Customer Personal Data on Customer's behalf.
Customer is the controller or business and Hagency is the processor or service provider for Customer Personal Data. Each party will comply with obligations applicable to its role. Customer is solely responsible for:
Customer warrants its instructions comply with Applicable Data Protection Law and will not cause Hagency to violate law. Customer will indemnify Hagency as provided in the Agreement for claims arising from unlawful Customer instructions or Customer's breach of this DPA.
Subject matter and purpose: providing, securing, supporting and maintaining a managed Hagency Server built on Matrix and related control-panel, storage, federation, bridge, identity, backup, export and support functions selected by Customer.
Duration: the term of the Agreement plus the limited period required to delete Customer Personal Data from active systems and rotating backups, or longer where law or a legal hold requires.
Nature of processing: collection, recording, organization, hosting, storage, retrieval, consultation, transmission, federation, bridging, encryption, backup, restoration, support access, restriction and deletion.
Data Subjects: Customer personnel and administrators; Workspace users, invitees and guests; participants and recipients in federated or bridged communications; support contacts; and other persons whose data Customer or its users submit.
Data categories: names, handles, Matrix and third-party identifiers, email addresses, avatars and profile data; authentication and device data; IP addresses, user agents, timestamps and audit events; room membership, relationship and communications metadata; messages, files, media and other content (encrypted or unencrypted depending on configuration); configuration, support and integration data.
Sensitive data: The Services are not designed for payment-card credentials, government identity secrets, passwords in message content, or special-category or highly regulated data unless a signed order expressly authorizes that processing. Customer will not submit such data without conducting required assessments and implementing appropriate safeguards.
Hagency will process Customer Personal Data only on Customer's documented instructions, unless law requires otherwise. The Agreement, Customer's use and configuration of the Services, authenticated administrator actions and support requests constitute instructions. Hagency may also process data as necessary to prevent abuse, maintain security and comply with law, in its role permitted by Applicable Data Protection Law. If legally required to process for another purpose, Hagency will inform Customer before processing unless law prohibits notice.
If Hagency reasonably believes an instruction violates Applicable Data Protection Law, it may suspend the affected processing and notify Customer, without undertaking a duty to provide legal advice. Customer remains responsible for modifying the instruction. Hagency is not required to follow instructions that are technically infeasible, outside the Services, unlawful or inconsistent with the Agreement.
Hagency will ensure personnel authorized to process Customer Personal Data are subject to contractual or statutory confidentiality obligations and receive access only as reasonably necessary for their duties. Confidentiality obligations survive the end of their access.
Taking into account the state of the art, implementation cost, nature and risks of processing, Hagency will maintain appropriate technical and organizational measures designed to protect Customer Personal Data. Measures include, as appropriate:
Customer acknowledges that security is a shared responsibility and that no measure guarantees absolute security. Customer is responsible for its devices, clients, identity providers, encryption keys, administrators, access rules, integrations and independent backups.
Customer grants general authorization for Hagency to engage Subprocessors. They may provide infrastructure, data-center, network, storage, content-delivery, security, monitoring, email, support and other operational services. Payment providers and third-party services with which Customer contracts directly may act as independent controllers rather than Subprocessors. A current Subprocessor list is available on request.
Hagency will impose written data-protection obligations on each Subprocessor that are no less protective in substance for the relevant processing than this DPA, and remains responsible for its Subprocessors to the extent required by Applicable Data Protection Law. Where required, Hagency will provide reasonable advance notice of a new Subprocessor. Customer may object within 15 days on specific, documented data-protection grounds. The parties will attempt a reasonable resolution. If none is available, Customer's sole remedy is to discontinue the affected feature or terminate the affected Service; refunds, if any, are governed by the Agreement.
Taking into account the nature of processing, Hagency will provide reasonable assistance through available functionality and support so Customer can respond to requests to exercise Data Subject rights. If Hagency receives a request concerning Customer Personal Data, it will ordinarily direct the requester to Customer and will not respond on Customer's behalf unless authorized or legally required. Customer is responsible for verifying the requester, deciding the response and using available administrator and export tools. Additional work outside standard functionality may be charged at agreed rates.
Hagency will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. Notification is not an admission of fault. As information becomes reasonably available, Hagency will provide the nature of the breach, likely consequences, categories of affected data and Data Subjects, approximate volume, measures taken or proposed, and a contact point. Information may be provided in phases and may be limited where law, security or confidentiality requires.
Customer is responsible for determining whether to notify authorities or Data Subjects and for meeting its legal deadlines. Hagency will take reasonable steps to contain, investigate and mitigate a breach and will reasonably cooperate, considering the nature of processing. These duties do not apply to incidents caused by Customer, its users, clients, keys, configuration, integrations or systems except to the extent the incident also constitutes a breach of Customer Personal Data within Hagency's control.
Considering the nature of processing and information available, Hagency will provide reasonable assistance with Customer's data-protection impact assessments and prior consultations required by law. Customer bears its own compliance responsibility and any reasonable costs for non-standard assistance. If Hagency receives a legally binding demand for Customer Personal Data, it will, where legally permitted, notify Customer and reasonably challenge demands it considers unlawful or overbroad. Hagency will disclose only data reasonably required by valid process.
During the term, Customer may use available export functions. On termination or Customer's valid deletion instruction, Hagency will delete Customer Personal Data from active systems in accordance with its technical deletion process, unless law requires retention. Data may remain temporarily in rotating backups, logs, caches, legal holds and immutable security records until ordinary expiration, during which it remains protected and is not restored except for disaster recovery or legal necessity. Hagency cannot delete copies held by federated servers, recipients, bridges, clients or third parties outside its control. The Agreement's deadlines, fees and disclaimers for export, backup, retention and recovery remain applicable.
Hagency will make available information reasonably necessary to demonstrate compliance, which may include security documentation, policies, summaries, certifications or third-party reports. Customer must first review this information and submit written questions. If required by Applicable Data Protection Law and the information is insufficient, Customer may request one audit in a 12-month period on at least 30 days' notice; additional audits are permitted after a confirmed material breach or regulator demand.
Audits must be limited to relevant systems and records, occur during normal business hours, avoid disruption and risk to other customers, and be conducted by an independent qualified auditor bound by confidentiality. No access to other customers' data, penetration testing or production credentials is permitted. Customer bears audit costs and reimburses Hagency's reasonable assistance costs, except where a material breach by Hagency is confirmed. For Free Services, remote documentation review is the exclusive audit method unless a regulator or mandatory law requires otherwise.
Customer authorizes processing in countries where Hagency or its Subprocessors operate. For Customer Personal Data subject to EEA transfer restrictions, the then-current EU Standard Contractual Clauses are incorporated as needed, using Module Two (controller to processor), with Customer as exporter and Hagency as importer; the optional docking clause applies, general authorization applies to Subprocessors, and the supervisory authority and governing law are determined by Customer's EEA establishment or otherwise a legally permitted EEA jurisdiction. For UK restricted transfers, the UK International Data Transfer Addendum modifies those Clauses. For Swiss transfers, references are adapted to the Swiss Federal Act on Data Protection. The processing details and security measures in this DPA complete the relevant annexes.
Where a lawful adequacy decision or alternative transfer mechanism applies, it controls for that transfer. Customer is responsible for transfers it initiates through federation, bridges, integrations, users or its own instructions.
Where United States privacy law applies, Hagency acts as Customer's service provider or contractor for Customer Personal Data. Hagency will not sell or share it for cross-context behavioral advertising; retain, use or disclose it outside the business purposes in the Agreement or the direct business relationship; or combine it with personal information received from another person except as permitted by law. Customer may take reasonable and appropriate steps to help ensure compliant use and may require remediation of unauthorized processing. Hagency will notify Customer if it determines it can no longer meet applicable obligations.
Each party's liability under this DPA is subject to the Agreement's exclusions and aggregate liability cap, to the maximum extent permitted by law. This DPA remains effective while Hagency processes Customer Personal Data. We may update it where reasonably necessary for law, official transfer mechanisms or changes to the Services. A materially reduced level of protection will be handled under the Agreement's notice provisions.